fsdb - HFS file system debugger
/usr/sbin/fsdb [-F hfs] [-V] special [-b blocknum] [-]
Always execute the fsck command (see fsck(1M)) after running fsdb.
The fsdb command can be used to patch up a damaged file system after a
Options and Arguments
fsdb recognizes the following options and arguments.
special The file name of the special file containing the
- Initially disable the error-checking routines that
are used to verify the inode and fragment
addresses. See the O symbol. If used, this
option must follow special on the command line.
-b blocknum Use blocknum as the superblock for the file
system. If used, this option must follow special
on the command line.
-F hfs Specify the HFS file system type.
-V Echo the completed command line, but perform no
other action. The command line is generated by
incorporating the user-specified options and other
information derived from the /etc/fstab file.
This option allows the user to verify the command
fsdb normally uses the first superblock for the file system, located
at the beginning of the disk section, as the effective superblock. An
alternate superblock can always be found at block
((SBSIZE+BBSIZE)/DEV_BSIZE), typically block 16. The -b option can be
used to specify the superblock location.
fsdb deals with the file system in terms of block fragments, which are
the unit of addressing in the file system and the minimum unit of
space allocation. To avoid possible confusion, fragment is used to
mean that, and block is reserved for the larger true block. fsdb has
conversions to translate fragment numbers and i-numbers into their
corresponding disk addresses. Also included are mnemonic offsets to
access different parts of an inode. These greatly simplify the
Hewlett-Packard Company - 1 - HP-UX Release 11i: November 2000
process of correcting control block entries or descending the file
fsdb contains several error-checking routines to verify inode and
fragment addresses. These can be disabled if necessary by invoking
fsdb with the optional - argument, or by using the O symbol.
Numbers are considered decimal by default. Octal numbers must be
prefixed with a zero. Hexadecimal numbers must be prefixed with 0x.
During any assignment operation, numbers are checked for a possible
truncation error due to a size mismatch between source and
fsdb reads a fragment at a time. A buffer management routine is used
to retain commonly used fragments of data in order to reduce the
number of read system calls. All assignment operations result in an
immediate write-through of the corresponding fragment.
The following symbols are recognized by fsdb:
! Escape to shell
# Absolute address
+ Address arithmetic
- Address arithmetic
<<<< Restore an address
>>>> Save an address
= Numerical assignment
=+ Incremental assignment
=- Decremental assignment
=" Character string assignment
b Convert from fragment number to disk address
d Directory slot offset
f File print facility
i Convert from i-number to inode address; for
continuation inodes as well as primary inodes (see
p General print facility
B Byte mode
D Double-word mode
O Error checking flip-flop
W Word mode
X Hexadecimal flip-flop
Dots, tabs, and spaces can be used as function delimiters, but are not
necessary. A line with just a newline character increments the
current address by the size of the data type last printed. That is,
the address is set to the next byte, word, double word, directory
entry, or inode, allowing the user to step through a region of a file
Hewlett-Packard Company - 2 - HP-UX Release 11i: November 2000
Information is printed in a format appropriate to the data type. If
the X toggle is off, bytes, words, and double words are printed in the
octal-address : octal-value (decimal-value)
If the X toggle is on, bytes, words, and double words are printed in
hex-address : hex-value
If the B (byte) or D (double-word) mode is in effect, the colon (:)
shown above is preceded by .B or .D, respectively.
Directories are printed as a directory slot offset followed by the
decimal i-number and the character representation of the entry name.
Inodes are printed with labeled fields describing each element.
The print facilities generate a formatted output in various styles.
Octal numbers are prefixed with a zero. Hexadecimal numbers are
prefixed with 0x. The current address is normalized to an appropriate
boundary before printing begins. It advances with the printing and is
left at the address of the last item printed. The output can be
terminated at any time by typing the interrupt character. If a number
follows the p symbol, that many entries are printed. A check is made
to detect fragment boundary overflows since logically sequential
blocks are generally not physically sequential. If a count of zero is
used, all entries to the end of the current fragment are printed. The
print options available are:
b Print as octal bytes
c Print as characters
d Print as directories
e Print as decimal words
i Print as inodes (primary or continuation)
o Print as octal words
x Print as hexadecimal words
The f symbol prints data fragments associated with the current inode.
If followed by a number, that fragment of the file is printed.
(Fragments are numbered from zero). The desired print option letter
follows the fragment number, if present, or the f symbol. This print
facility works for small as well as large files except for special
files such as FIFOs, and device special files.
Inode and Directory Mnemonics
The following mnemonics are used for inode examination and refer to
Hewlett-Packard Company - 3 - HP-UX Release 11i: November 2000
the current working inode:
anum Data block numbers (num is in the range 0 - 14)
at Time last accessed
ci Continuation inode number
ct Last time inode changed
gid Group ID number
ln Link count
maj Major device number
min Minor device number
mt Time last modified
sz File size in byte unit
uid User ID number
The following mnemonics are used for directory examination:
di I-number of the associated directory entry
nm Name of the associated directory entry
386i Print i-number 386 in an inode format. This now
becomes the current working inode.
ln=4 Change the link count for the working inode to 4.
ln=+1 Increment the link count by 1.
fc Print in ASCII fragment zero of the file associated
with the working inode.
2i.fd Print the first fragment-size piece of directory
entries for the root inode of this file system.
d5i.fc Change the current inode to that associated with the
fifth directory entry (numbered from zero) found from
the above command. The first fragment's worth of bytes
of the file are then printed in ASCII.
1b.px Print the first fragment of the superblock of this file
system in hexadecimal.
2i.a0b.d7=3 Change the i-number for the seventh directory slot in
the root directory to 3. This example also shows how
several operations can be combined on one command line.
Change the name field in the directory slot to the
given string. Quotes are optional if the first
character of the name field is alphabetic.
Hewlett-Packard Company - 4 - HP-UX Release 11i: November 2000
a2b.p0d Print the third fragment of the current inode as
Only experienced users should use fsdb. The failure to fully
understand the usage of fsdb and the file system's internal
organization can lead to complete destruction of the file system and
total loss of data.
fsdb was developed by HP and AT&T.
/etc/fstab Static information about the file systems
dumpfs(1M), fsck(1M), fsdb(1M), stat(2), dir(4), fs(4).
Hewlett-Packard Company - 5 - HP-UX Release 11i: November 2000